From owner-svn-src-head@freebsd.org Thu Oct 8 11:45:11 2020 Return-Path: Delivered-To: svn-src-head@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 86C513FE087; Thu, 8 Oct 2020 11:45:11 +0000 (UTC) (envelope-from kaktus@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4C6TsM33Bjz3g4C; Thu, 8 Oct 2020 11:45:11 +0000 (UTC) (envelope-from kaktus@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4BF998511; Thu, 8 Oct 2020 11:45:11 +0000 (UTC) (envelope-from kaktus@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 098BjBaO018734; Thu, 8 Oct 2020 11:45:11 GMT (envelope-from kaktus@FreeBSD.org) Received: (from kaktus@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 098BjBun018733; Thu, 8 Oct 2020 11:45:11 GMT (envelope-from kaktus@FreeBSD.org) Message-Id: <202010081145.098BjBun018733@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: kaktus set sender to kaktus@FreeBSD.org using -f From: Pawel Biernacki Date: Thu, 8 Oct 2020 11:45:11 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r366537 - head/libexec/rc/rc.d X-SVN-Group: head X-SVN-Commit-Author: kaktus X-SVN-Commit-Paths: head/libexec/rc/rc.d X-SVN-Commit-Revision: 366537 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.33 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Oct 2020 11:45:11 -0000 Author: kaktus Date: Thu Oct 8 11:45:10 2020 New Revision: 366537 URL: https://svnweb.freebsd.org/changeset/base/366537 Log: [pf] /etc/rc.d/pf should REQUIRE routing When a system with pf_enable="YES" in /etc/rc.conf uses hostnames in /etc/pf.conf, these hostnames cannot be resolved via external nameservers because the default route is not yet set. This results in an empty (all open) ruleset. Since r195026 already put netif back to REQUIRE, this change does not affect the issue that the firewall should rather have been setup before any network traffic can occur. PR: 211928 Submitted by: Robert Schulze Reported by: Robert Schulze Tested by: Mateusz Kwiatkowski No objections from: kp MFC after: 3 days Modified: head/libexec/rc/rc.d/pf Modified: head/libexec/rc/rc.d/pf ============================================================================== --- head/libexec/rc/rc.d/pf Thu Oct 8 11:30:22 2020 (r366536) +++ head/libexec/rc/rc.d/pf Thu Oct 8 11:45:10 2020 (r366537) @@ -4,8 +4,7 @@ # # PROVIDE: pf -# REQUIRE: FILESYSTEMS netif pflog pfsync -# BEFORE: routing +# REQUIRE: FILESYSTEMS netif pflog pfsync routing # KEYWORD: nojailvnet . /etc/rc.subr